CVE-2026-40139: critical vulnerability in BeyondTrust Remote Support
Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. It has an official Brazilian government alert.
ssvc Trackcvss 9.2epss 0.8%
Official alert in Brazil
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CISC Gov.br · 14 Jul 2026Boletim do CISC de Vulnerabilidaderead on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Related CVEs — BeyondTrust Remote Support
In the same product, most dangerous first.
CVE-2024-12356CRITICALCommand Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)EPSS 87.4%KEVCVE-2026-102764CRITICALImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote SupportEPSS 78.0%KEVCVE-2026-40140HIGHHigh-Severity Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.6%CVE-2026-40141HIGHHigh-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.5%CVE-2026-40138CRITICALCritical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.5%CVE-2025-0217HIGHPrivileged Remote Access Authentication BypassEPSS 0.2%